MissionDefend Blog

Home Articles Get your free assessmentComing soon

Author: Mission Defend Staff

  • The 10-Minute Security Talk to Give Every New Volunteer

    When something goes wrong with a church’s accounts, it is almost never a shadowy figure in a hoodie breaking down a digital door. It is usually someone kind. A volunteer who clicked because the email looked urgent. A staff member who wired money because the message seemed to come from the pastor. The Cybersecurity and Infrastructure Security Agency puts it plainly in its Secure Our World guidance: most of the everyday risk comes down to a handful of human habits, not exotic hacking. Which is actually good news. It means your best protection is not an expensive system. It is a short, warm conversation you have with every new person who joins.

    So let’s talk about that conversation. It takes about ten minutes, and you can give it to a new volunteer over coffee, at the same moment you hand them a building key. That timing matters, so let me come back to it. First, here is what you actually need to say.

    The few things worth saying

    You do not need a policy binder. You need five or six plain ideas, spoken like a person, not a compliance officer.

    Start with accounts. Ask them to use a strong, unique password for anything connected to the church — the giving platform, the email, the shared calendar — and to turn on the second sign-in step, the one that texts a code or pings an app when they log in. You can tell them the honest reason: that second step is the single thing that stops most stolen passwords from actually working. It feels like a small nuisance the first week and then you forget it is there.

    Then draw a gentle line around church accounts. The church login is for church work. It is not the place to reuse a personal password, and personal browsing habits do not need to ride along on the account that touches the congregation’s information. You can say this warmly. It is not a rule about their character. It is just keeping two rooms separate.

    Next, and this is the heart of it, teach them to be a little suspicious of urgency, especially anything about money or passwords. Almost every scam that lands on a church leans on the same trick: it makes you feel rushed. A text that looks like it is from the pastor asking for gift cards right now. An email saying an account will be closed unless you confirm your login today. Tell your new volunteer that the church will never operate that way, and that the fix is simple and free: when a request about money or credentials feels urgent, verify it through a second channel. If the “pastor” texts, call the number you already have. If the “bank” emails, log in the way you always do, not through their link. A real request survives a phone call. A scam usually does not.

    The most important sentence

    Here is the line I would have you repeat, maybe twice, so it sticks: when in doubt, ask — and asking is always the right call, never a bother. Say it and mean it. New people carry a quiet fear of looking foolish, of being the one who bothered a busy staff member over something that turned out to be nothing. That fear is exactly what scammers count on. So take it off the table on day one. Tell them that a forwarded “is this real?” email is not an interruption; it is the volunteer doing their job well. There is no such thing as a dumb question here, and the person who asks is the person we are grateful for.

    Then tell them who to ask. Give a name and a way to reach that person — the office manager, the tech-minded elder, whoever it is — so that “ask someone” is not an abstract instruction but a specific face. If something looks wrong, if a login screen seems off, if a message makes their stomach drop a little, they should know precisely who to tell and that telling that person early is always welcome, even at nine on a Saturday night.

    Why we frame it the way we do

    Somewhere in these ten minutes, say the thing underneath all of it. None of this is because you distrust them. You are handing them the keys precisely because you do trust them. All of these small habits exist to protect the people the church serves — the family whose giving records are in that system, the member who confided something in a pastoral email, the widow whose donation should reach the ministry and not a thief. Framed that way, security stops sounding like suspicion and starts sounding like care. People absorb it because it matches why they showed up to serve in the first place.

    Keep the tone warm the whole way through. A lecture makes people nod and forget. A friendly, human conversation makes them remember. The Federal Trade Commission’s small-business materials make the same point in a different key: the practices that protect an organization are ordinary and teachable, and they work best when they are part of the culture rather than a binder on a shelf.

    When to give it, and who gives it

    Give this talk during onboarding, folded into the same welcome where you show someone where the coffee is and hand over their key. Do not save it for a special training day that may never come. If a person is trusted enough to hold a key, they are ready for the ten minutes. As for who gives it — whoever welcomes new people already is the right person. It does not need to be the most technical staff member. It needs to be someone warm, because the warmth is what makes it land.

    Do this consistently, with every newcomer, and something quietly shifts. You build a team where asking is normal, where “this looks strange, can you check?” is a sentence people say without embarrassment. That culture — not any single tool — is your strongest defense. A congregation where people feel safe raising a hand is a congregation that catches problems while they are still small.

    If you want a simple, plain-English starting point for the rest of your posture, you can get first in line for our free assessment when it opens. But the ten-minute talk you can give this week, for free, before any of that.

    Sources

    • Cybersecurity and Infrastructure Security Agency (CISA), Secure Our World — cisa.gov/secure-our-world
    • National Institute of Standards and Technology (NIST), Small Business Cybersecurity Corner — nist.gov/itl/smallbusinesscyber
    • Federal Trade Commission (FTC), Cybersecurity for Small Business — ftc.gov/business-guidance/small-businesses/cybersecurity

  • How to Set Up a Guest Wi-Fi Network (and Secure Your Router) at Your Church

    Picture the Wi-Fi at your church the way it probably works right now. There is one network. The guest checking Facebook in the lobby is on it. The tablet the kids’ ministry uses for check-in is on it. And the office computer that holds your membership roster, your giving records, and everyone’s contact information is on it too. They are all sitting in the same room, so to speak, with the same door open between them.

    Most churches never planned it that way. Somebody set up the internet years ago, the password got written on a sticky note or printed in the bulletin, and it has quietly worked ever since. Nobody meant to put the visitors and the donor records on the same network. It just happened, the way most things at a church happen, because someone kind volunteered to handle it and then life moved on.

    Here is the good news before we go any further. Fixing this is almost certainly not a hardware problem, and it is not a full day of technical misery. For most churches it is a settings change you can make in one afternoon, using the router you already own. You do not need to buy anything. You do not need to be technical. You need about the same patience it takes to set up a new phone.

    Why one flat network is a quiet risk

    Think of your Wi-Fi network like your church building. A guest network is the difference between welcoming a visitor into the lobby and handing them a master key to every room, including the office where the filing cabinets live. You want people to feel welcome. You just do not want the welcome to include your treasurer’s computer.

    When everyone shares a single network, a device that gets compromised, say a visitor’s phone that picked up something nasty from an app, is now sitting on the same network as the machine with your member data. It does not mean disaster is coming. It means there is an open hallway where there should be a wall, and building the wall is easy.

    The fix: a separate network for guests

    The wall is called a guest network, and the surprising part is that your router very likely already has one built in. Most modern routers, the box your internet comes through, include a simple guest network toggle. When you turn it on, it creates a second Wi-Fi network with its own name and its own password. Visitors who join it get exactly what they came for, which is internet, and nothing else. They cannot see or reach your office devices. The guest network gives them the lobby and keeps the office door shut.

    You reach these settings by opening the router’s admin page, usually by typing an address like 192.168.1.1 into a web browser, or through the app that came with the router. Somewhere in the settings you will find a section for the guest network. Give it a friendly name, something like “Grace Church Guest,” set a password you are comfortable sharing, and save. That is genuinely most of the work.

    The one step almost everyone skips

    While you are in there, do the single most important thing on this whole list, the one that gets overlooked more than any other. Change your router’s admin password.

    This is not your Wi-Fi password, the one people type to get online. It is the separate password that lets someone into the router’s own control panel, where all these settings live. Routers ship from the factory with a default admin login, often something like “admin” and “password,” and here is the uncomfortable truth: those defaults are public knowledge. They are printed in manuals and listed on websites anyone can find. Leaving the default in place is like installing a good lock and taping the key to the door. The Federal Trade Commission specifically advises changing the router’s default name and password as a first step in securing a network. Take five minutes and set something long and unique. Write it down somewhere safe, like your other important church passwords, so the next volunteer is not locked out.

    A few more settings worth turning on

    With the big two done, a handful of smaller settings round things out. Set a strong password on your main Wi-Fi, the one your staff and office devices use, and keep it separate from the guest password. Make sure your encryption is turned on and set to WPA2 or, if your router offers it, WPA3. These are just the settings that scramble your Wi-Fi so outsiders cannot eavesdrop, and on most routers you simply pick the option from a menu. The FTC recommends using the strongest encryption your router supports.

    Check that your router’s firmware is up to date. Firmware is the software running inside the router itself, and manufacturers release updates that fix security holes. Many routers can update themselves automatically if you switch that setting on, which is the easiest thing to do. The Cybersecurity and Infrastructure Security Agency lists keeping router firmware updated among its basic guidance for securing a home or small-office network.

    And if you want, rename your main office network to something plain that does not announce itself. There is no need to name it “Church Office Finance.” Something forgettable draws less attention.

    What if the router is old, or the internet company owns it

    Two honest exceptions. If your router is genuinely ancient, it may not have a guest network option, and that is a fair reason to consider a newer one, though it is still not urgent for most churches. And if your internet came bundled with equipment from your provider, the settings sometimes live in their app or require a quick call to them. If any of this feels like a wall rather than a hallway, you have easy help available. Call your internet provider and ask them to enable a guest network for you, or hand this article to the most patient volunteer you know and let them spend the afternoon. Neither path requires you to become a network engineer.

    You built a place where people feel welcome. A guest network just lets you keep that welcome warm at the front door while the office stays quietly, safely locked in the back. One afternoon, and it is done.

    If you would like a plain-English starting point for the rest of your church’s security posture, get on the list to be first in line when our free assessment opens.

    Sources

    • Federal Trade Commission, “Securing Your Home Network / Wi-Fi Router,” consumer.ftc.gov
    • Federal Trade Commission, “Cybersecurity for Small Business,” ftc.gov
    • Cybersecurity and Infrastructure Security Agency, “Home Network Security” and Secure Our World guidance, cisa.gov
    • Federal Communications Commission, “Small Biz Cyber Planner,” fcc.gov

  • Protecting the Member and Donor Data Your Ministry Holds

    Think for a moment about everything people have handed you. A new family fills out a card and writes down their address, their kids’ names and ages, maybe a note about a hard season they’re walking through. A donor sets up recurring giving and trusts you with a bank routing number. Someone asks the prayer team to hold something they’ve told almost no one else. A volunteer submits a background check. None of these people thought of it as handing over data. They thought of it as trusting you.

    That trust is the real thing you’re protecting. The spreadsheets and the database and the giving platform are just where the trust happens to live. When we talk about protecting member and donor information, we’re not talking about a technical chore. We’re talking about a form of care — the same care you’d give if someone left their house key with you for the weekend. Guarding what people entrust to you is part of stewardship, right alongside how you handle the offering.

    Here’s the freeing part, and it’s the single most important idea in this whole post: you cannot lose what you do not have. The most powerful thing you can do to protect people’s information is to collect less of it and keep it for less time. Every field on a form, every old spreadsheet, every archived inbox is something you’re now responsible for. So the question to ask about any piece of information isn’t “could this ever be useful?” — almost anything could. The question is “do we actually need this to do what we do?” If a volunteer form asks for a Social Security number that no one has looked at in three years, that’s not data you’re protecting. It’s data that’s quietly protecting no one and putting people at risk. Collecting only what you truly need is the closest thing to a magic wand you’ll find here.

    Once you’ve trimmed down to what you genuinely use, the next habit is simply knowing where it lives. This sounds obvious, but most ministries have never actually mapped it. Member details might be in your church management software, but also in a deacon’s personal spreadsheet, in three or four staff inboxes, on a sign-up sheet someone photographed, and in a shared drive folder no one remembers creating. You can’t protect what you can’t find. Spend an afternoon writing down, in plain language, every place sensitive information sits: which platforms, which spreadsheets, whose inboxes, which shared folders. The Federal Trade Commission, in its guide “Protecting Personal Information: A Guide for Business,” makes exactly this point — knowing what personal information you have and where it’s stored is the foundation everything else rests on. You’re not doing anything fancy. You’re just turning on the lights.

    With the lights on, two things usually become clear. The first is that too many people can see too much. Not out of any bad intent — access just accumulates. A volunteer who helped with one event three years ago still has the keys to the whole directory. The gentle fix is to let access follow need: the person who counts the offering sees giving records, the person who plans meals sees dietary notes, and neither needs the other’s information. Limiting who can see what isn’t about distrust. It’s about not asking people to carry a responsibility they never signed up for.

    The second thing that becomes clear is that some of your most sensitive information is living in the most fragile places — a benevolence log on someone’s personal laptop, a donor list emailed around as an attachment, counseling notes in a plain document anyone with the link can open. This is where reputable platforms earn their keep. A well-chosen church management system or giving platform encrypts information, controls who can open it, and keeps it off random personal devices and out of unprotected spreadsheets. You don’t need to understand encryption to benefit from it; you just need to choose tools built by people who do, and then actually use them instead of the convenient workaround. Moving the benevolence records off the laptop and into the system your church already pays for is often the single most protective thing a small office can do in an afternoon. The National Council of Nonprofits, in its cybersecurity guidance for nonprofits, encourages exactly this posture — relying on trustworthy tools and sound basic practices rather than assuming your size makes you invisible.

    Then there’s the part almost everyone forgets: letting go. Information doesn’t stop being a risk when you stop using it. The former volunteer’s file, the ten-year-old member list, the giving records from a program that ended — all of it sits there as risk with no remaining benefit. So build a simple habit of disposing of what you no longer need. Decide, in plain terms, how long you’ll keep different kinds of records, and then actually delete or shred them when that time comes. Old data you’ve responsibly let go of is old data that can never be lost, leaked, or misused.

    The last habit costs nothing and buys enormous goodwill: be honest with people about what you keep. A short, plain sentence — “here’s what we collect, here’s why, and here’s how we protect it” — turns a vague unease into trust. People rarely mind that you hold their information. They mind being surprised by it.

    You do not need to become a privacy lawyer to do any of this well. You don’t need to memorize regulations or buy expensive tools. A handful of sensible habits — collect less, know where it lives, limit who can see it, use good platforms, throw out what you don’t need, and tell people the truth — covers the large majority of the real risk. The rest is just the ordinary faithfulness of taking care of what you’ve been given.

    If you’d like a simple, plain-English starting point, MissionDefend is building a free assessment to help churches and nonprofits see where their information lives and where the gaps are. You can get on the launch list and be first in line when it opens.

    Sources

    • Federal Trade Commission, “Protecting Personal Information: A Guide for Business” (ftc.gov)
    • National Council of Nonprofits, cybersecurity and data-protection guidance for nonprofits (councilofnonprofits.org)
    • National Institute of Standards and Technology, Small Business Cybersecurity Corner (nist.gov)

  • Think an Account’s Been Hacked? Here’s How to Tell — and What to Do First

    Take a breath. If you’re reading this because something feels off with one of your ministry’s accounts, the most useful thing you can do right now is stay calm and move in order. Most of the damage from a compromised account is done — or prevented — in the first hour, and you have more control than it feels like you do. Let’s walk through it together.

    How to tell something’s actually wrong

    Sometimes it’s obvious: you go to sign in and your password no longer works, or you get a message that your account has been locked. Other times it’s quieter, and quieter is often more dangerous. A volunteer mentions they got a strange email or text “from you” asking for gift cards or a quick favor. People on your contact list start replying to messages you never sent. You notice password-reset emails arriving that you didn’t request, or sign-in alerts from a city or device you don’t recognize.

    Watch especially for the sneaky signs inside the account itself. An attacker who gets into email will often set up a quiet forwarding rule or a filter so that copies of your incoming mail get sent to them — or so that certain messages skip your inbox entirely and land in the trash where you’ll never see them. You might also notice that money has moved, that your giving platform’s payout or bank details have changed, or that a login you use for donations suddenly behaves differently. Any one of these is worth taking seriously.

    The first moves, in order

    If you can still get into the account, act quickly and in sequence. First, change the password — and make it a strong, unique one you’ve never used anywhere else. Don’t recycle an old favorite. Once the new password is set, look for the option to sign out of all other sessions and devices. Most email and account providers offer this, and it’s the step that actually kicks the intruder out; changing the password alone doesn’t always end a session they already have open.

    Next, turn on the second sign-in step — often called multi-factor authentication, or MFA — if it wasn’t already on. This is the single most effective thing you can do to keep them from walking back in, because even if they somehow learn your new password, they can’t get past that second check without your phone. The Cybersecurity and Infrastructure Security Agency (CISA) has been blunt about this: turning on multi-factor authentication makes you significantly less likely to get hacked. It’s worth the two minutes.

    Once that’s done, go hunting for what the attacker may have left behind. Open your email settings and check the forwarding and filter rules. If you find a rule you didn’t create — anything quietly copying your mail elsewhere or auto-deleting messages — remove it. This is the step people miss most often, and it’s the one that lets an attacker keep reading your mail long after you’ve changed the password. While you’re in the settings, review the list of connected apps that have access to your account and revoke anything unfamiliar, and check your recovery information — the backup email address and phone number — to make sure they still point to you and not to a stranger.

    If money or personal data is involved

    If this is an account that touches your ministry’s money or holds people’s personal information — your email, your giving platform, your accounting login — pause and tell your designated person right away. That might be your treasurer, your bookkeeper, or whoever you’ve agreed handles this. Two calm heads are better than one anxious one. Then check the accounts that matter: log in to your bank and your giving or payment platform directly (type the address yourself rather than clicking a link in any email), and look for changes to payout details, new payees, or transactions you don’t recognize. If something’s wrong, call the bank or platform’s support line and tell them the account may be compromised.

    If you’re already locked out

    If your password no longer works and you can’t get in at all, don’t keep guessing — go to the provider’s official account-recovery process. Every major provider, Google and Microsoft included, has a “forgot password” or “I can’t sign in” path built for exactly this moment. It will walk you through verifying that you’re the real owner. If the attacker changed your recovery phone or email, the recovery flow usually has a way to prove ownership anyway, so be patient and follow the prompts. Resist the urge to create a brand-new account and abandon the old one; recovering the original is almost always the cleaner path.

    Be honest, and be prompt

    If there’s any chance someone else’s information was exposed — donors, staff, the people in your directory — tell them plainly and soon. A short, honest note saying “our email was compromised, please ignore any odd messages from us, and never send money or gift cards based on a message you weren’t expecting” does enormous good. People understand that these things happen. What they remember is whether you were straight with them. The Federal Trade Commission’s guidance on hacked accounts makes the same point: alerting your contacts quickly helps stop the scam from spreading through the people who trust you.

    The reassuring part

    Here’s what to hold on to. Acting fast in that first hour contains most of the damage, and none of the steps above require you to be technical — they require you to be calm and to go in order. The best gift you can give your future self is to decide, today, before anything goes wrong, who you’d call and what you’d check first. Write it down. Tape it inside a drawer if you have to. A plan you made on a quiet afternoon is worth ten frantic guesses at midnight.

    If you’d like a simple, plain-English baseline of where your ministry stands — before there’s ever an emergency — join our launch list and you’ll be first in line when our free assessment opens.

    Sources

    • Federal Trade Commission, “Hacked Email” — consumer.ftc.gov
    • Cybersecurity and Infrastructure Security Agency (CISA), “More than a Password” / multi-factor authentication guidance — cisa.gov
    • Google Account Help, “Recover your Google Account or Gmail” — support.google.com
    • Microsoft Support, “Recover a hacked or compromised account” — support.microsoft.com

  • How to Lock Down Your Church’s Online Giving Platform

    Think for a moment about everything that flows through your online giving page. Every Sunday gift someone sets up on their phone. The recurring donations from families who have supported you for years. The names, email addresses, and giving histories of the people who trust you most. And underneath all of it, a bank account where every dollar eventually lands. When you put it that way, it’s easy to see why someone with bad intentions would find your giving platform far more interesting than almost anything else your church runs online. It sits right where the money and the donor information meet.

    Here’s the encouraging part, and it’s the thing I most want you to hold onto: you did not build the payment technology, and you are not expected to. That part is handled by professionals. Your job is much smaller and much more manageable than it sounds. You are guarding a front door and keeping an eye on the money as it moves. That’s it. Let’s walk through what that actually looks like.

    Why the giving platform is the target

    Attackers follow the money, and your giving platform is where the money is. But it’s not only the deposits they’re after. A donor list is valuable on its own. Names paired with email addresses and a history of generosity are exactly the ingredients someone needs to send convincing scam messages to your congregation later. So when we talk about protecting the giving platform, we’re really protecting two things at once: the funds that keep the lights on, and the trust of the people who gave them.

    The good news is that the most effective protections here are not technical wizardry. They’re mostly about who can get in, and about slowing down long enough to double-check when money is involved.

    Put a strong lock on the admin door

    The single most important habit is turning on multi-factor authentication for every person who has administrative access to the platform. You may have heard it called MFA, two-factor, or two-step verification. It simply means that logging in takes a password plus one more thing, usually a code from a phone. The reason it matters so much is that passwords get guessed, reused, and stolen all the time, and that second step stops a stranger cold even when they’ve gotten hold of the password. The Cybersecurity and Infrastructure Security Agency, the federal agency that advises organizations on exactly this kind of thing, treats multi-factor authentication as one of the most powerful steps any organization can take. Turn it on for everyone who can log in as an administrator, no exceptions.

    While you’re in there, take a hard look at who actually needs that administrative access. It’s tempting to give everyone the keys so nobody’s ever locked out, but every additional admin is another door someone could slip through. Keep the number of full administrators as small as you reasonably can. And make sure each person has their own individual login. Shared accounts feel convenient, but they make it impossible to know who did what, and when one leaves, the password walks out with them. Individual logins mean you can remove someone’s access the moment they’re no longer serving in that role.

    The one that actually saves the money

    If you remember nothing else from this whole post, remember this. The most common way churches and nonprofits lose real money through a giving platform is not a dramatic hack. It’s a quiet request to change where the deposits go. Someone sends an email or a message that looks like it’s from your platform, your bank, or even a staff member, asking you to update the payout or bank account details. If you make that change, the next batch of donations lands in a stranger’s account instead of yours.

    The defense is simple, and it works every time you use it. Any change to the payout or bank account information gets verified through a second, separate channel before you touch anything. If a request arrives by email, you confirm it with a phone call to a number you already know is real, not the number in the message. If someone tells you in person, you still verify through the platform’s official settings. The FBI’s Internet Crime Complaint Center has documented for years that this kind of payment-redirection fraud drains enormous sums from organizations, and their advice comes down to the same discipline: independently confirm any change to payment instructions before acting. A two-minute phone call is the cheapest insurance you will ever buy.

    Keep watch, and reconcile

    Even with good locks and good habits, you want to be the one who notices if something is off, and to notice quickly. Make it a routine to look at your payouts and reconcile what the platform reports against what actually arrives in your bank account. If a diversion or an error ever slips through, regular reconciliation is what catches it in days rather than months. This isn’t a burden reserved for the finance committee; it’s just the ordinary rhythm of paying attention to the money you’ve been entrusted with.

    The part you don’t have to worry about

    Here’s a genuine relief. A reputable giving platform or payment processor handles the sensitive card data for you, and it does so under a strict industry standard maintained by the PCI Security Standards Council. That means the actual card numbers are their responsibility, not yours. Your church should never store card numbers itself, never write them down, never keep them in a spreadsheet. If you’re ever tempted to, stop. The whole point of using a real processor is that you get to hand that risk to someone built to carry it.

    Guard the front door, verify the money

    So let’s bring it back to where we started. Keep the login to your giving platform separate from your other accounts and protected with a strong, unique password and that second step. Look at the platform’s own security settings and turn on whatever protections it offers, especially any alerts for logins or changes to payout details. Then simply keep the circle of administrators small, and verify any movement of money through a second channel.

    That’s the whole job. You don’t run the payment technology, and you don’t need to. You guard the front door, and you double-check the money when it moves. Do those two things faithfully, and your giving platform becomes one of the best-protected parts of your ministry.

    If you’d like a plain-English check of where your church stands today, get on the MissionDefend launch list and you’ll be first in line when our free assessment opens.

    Sources

    • FBI Internet Crime Complaint Center (IC3), “Business Email Compromise” — ic3.gov
    • Cybersecurity and Infrastructure Security Agency (CISA), “More Than a Password” (multi-factor authentication guidance) — cisa.gov
    • PCI Security Standards Council, “PCI Security Standards Overview” — pcisecuritystandards.org
    • Federal Trade Commission, “Cybersecurity for Small Business” — ftc.gov

  • Set Up a Password Manager for Your Ministry Team (Without the Overwhelm)

    If your team is still keeping passwords in a shared spreadsheet, on sticky notes around the office, or in one person’s memory, you are not alone. Almost every church and small nonprofit starts there. It works right up until the day it doesn’t — when a volunteer leaves, an account gets locked, or someone reuses the same password in one too many places. The good news is that fixing this is one of the most doable things on your whole security to-do list, and it starts with understanding why passwords fail in the first place.

    The real problem isn’t weak passwords — it’s reused ones

    Here’s the part that surprises most people. The biggest danger usually isn’t that your password is too short or too simple. It’s that the same password is being used in more than one place. When a big company somewhere has a data breach — and these happen constantly, to organizations far larger than yours — the stolen passwords get collected and tried against other accounts, automatically, by the thousands. So the password your treasurer uses for the church bank login is only as safe as the least careful website where they also used it. One forgotten account on some hobby forum from years ago, and suddenly the key to something that actually matters is floating around.

    You can’t out-clever this by making one really good password and using it everywhere. The only real fix is a different, strong password for every single account. And no human being can remember dozens of those. That’s exactly the problem a password manager was built to solve.

    What a password manager actually is

    Think of it as a locked safe that lives on your devices and remembers all your passwords for you. When you sign up for something, it creates a long, random, impossible-to-guess password and stores it. When you go back to that site, it fills the password in for you automatically. You never have to type it, remember it, or even know what it is.

    The beautiful trade at the heart of this is simple: you remember one password — the one that opens the safe — and it remembers all the rest. That’s it. Instead of juggling twenty passwords badly, you protect one password well.

    You have real choices here, too. There are several reputable password managers on the market, a number of them with capable free tiers that are perfectly good for a small team, and many vendors offer nonprofit discounts on their paid plans. It’s worth a quick search for the current nonprofit pricing before you decide. This is not a place where you have to spend a lot of money to be much safer.

    The master password: your one key, guarded well

    Because that one master password unlocks everything, it deserves real care. Make it long — a short phrase of a few unrelated words strung together is both strong and much easier to remember than a jumble of symbols. NIST, the federal agency that sets these standards, has found that length matters more than forced complexity, which is genuinely freeing news. And do not reuse your master password anywhere else. It should be the one password in your life that exists in only one place.

    Then back it up somewhere physical and safe. Write it down and put it in a locked drawer, a safe, or a sealed envelope with your important documents. This feels backwards to a lot of people — aren’t we told never to write passwords down? But a slip of paper in a locked drawer at home is not the thing attackers can reach from the other side of the world. Losing access to your entire vault because you forgot the one key is a far more likely disaster, and this simple step prevents it.

    Sharing logins the safer way

    Every church has a few accounts that genuinely need to be shared — the main email, the social media pages, maybe the giving platform. Good password managers have a feature built exactly for this: a shared vault. You put those shared logins in one place, and the specific people who need them get access, without anyone ever having to text a password around or read it aloud in a meeting. When a volunteer moves on, you remove their access in a moment, and nobody has to scramble to change passwords everywhere.

    Where you can, though, individual logins still beat sharing. When each person has their own account on a platform, you can see who did what, and you can remove one person without disrupting everyone else. Save the shared vault for the accounts that truly only come in one flavor.

    Rolling it out without overwhelming anyone

    The mistake that sinks most of these efforts is trying to move everything at once. Don’t. Start small. Pick the handful of accounts that would hurt the most if they were lost — your email, your banking, your donor or giving platform — and move just those in. Let everyone get comfortable with the fill-it-in-for-you rhythm on the accounts they touch daily. Once it feels normal, add a few more. Over a few weeks, without any single overwhelming afternoon, your team ends up fully covered. Slow and steady genuinely wins here.

    “But what if I forget the master password?”

    This is the fear that keeps people from ever starting, so let’s answer it honestly. Yes, forgetting the master password is a real risk, and most password managers are designed so that even the company itself cannot see or reset it — that’s precisely what keeps your vault private. But you are not without a net. Many services offer recovery options you can set up in advance, like a printed recovery key or a trusted emergency contact. Set those up on day one, before you need them. And keep that written copy in a safe physical place, as we talked about. Do both, and the thing you’re afraid of quietly stops being possible.

    None of this has to happen today, and none of it has to happen all at once. Pick one account, set up one vault, remember one password. That single step puts you ahead of most organizations your size — and your people, your donors, and your mission are safer for it.

    Want a gentle, plain-English checkup of where your ministry stands? Get on the launch list and be first in line when our free assessment opens.

    Sources

    • NIST, Digital Identity Guidelines (SP 800-63B) — guidance on password length, memorized secrets, and why length beats forced complexity. nist.gov
    • CISA, “Use Strong Passwords” / Secure Our World — federal guidance recommending password managers and unique passwords for every account. cisa.gov
    • Federal Trade Commission, Cybersecurity for Small Business — plain-language security basics for small organizations. ftc.gov

  • How to Explain Cyber Risk to Your Board Without Scaring Them

    Somewhere between the budget line for the roof and the discussion about the fall fundraiser, you have to bring up cybersecurity. And you already know how it can go. Either eyes glaze over because it sounds like an IT problem for someone else, or you scare everyone with breach headlines and the room agrees it’s terrifying and then does nothing about it. Neither one gets you what you actually need, which is a decision.

    The good news is that a board doesn’t need to understand security. They need to understand risk, and risk is something a board already knows how to talk about. They weigh it every time they approve an insurance policy, sign a lease, or decide whether to run a capital campaign. Your job isn’t to turn them into technologists. It’s to translate a technical subject into the language of stewardship and decisions they already speak.

    Lead with what you’re protecting, not what you’re afraid of

    The mistake most people make is opening with the threat — hackers, ransomware, breaches. That puts the board in a defensive crouch, and frightened people tend to freeze rather than act. Open instead with what’s yours to protect.

    Your organization holds things people trusted you with. Members’ names, addresses, and family details. Donors’ giving records and, on the payment side, their financial information. Bank access. Sometimes counseling notes or benevolence requests that were shared in confidence. A board understands custody. So frame it that way: “We hold sensitive information about our members and donors, and part of our responsibility is keeping it safe. I want to spend ten minutes on how we’re doing that.” Now it’s a stewardship conversation, and stewardship is the board’s whole job.

    Translate the risk into terms a board already weighs

    Boards think in terms of likelihood and impact, even if they don’t use those words. You can meet them there without a single technical term.

    On likelihood, the honest and useful message is that small organizations are targeted precisely because they’re small. Attacks on churches and nonprofits are mostly automated and opportunistic — nobody is singling you out, but the internet is full of programs that knock on every door looking for one that’s unlocked. Being small and mission-focused doesn’t make you invisible; it often makes you an easier target than a bank with a security team.

    On impact, keep it concrete and local. The damage from an incident isn’t abstract “cyber” harm; it’s a diverted wire transfer that empties an account, a week where staff can’t get into email or files, member data exposed and a hard conversation with the people it belongs to, and the quiet erosion of trust that’s harder to measure than any dollar figure. You don’t need to inflate any of this. Stated plainly, it lands.

    Bring one number, not ten

    Resist the urge to build a slide of statistics. A board remembers one well-chosen figure and forgets a wall of them. Pick a single anchor that fits your point — for example, the FBI’s Internet Crime Complaint Center reports that business email compromise, the scam where an attacker impersonates a leader or vendor to redirect a payment, has driven billions in reported losses, with an average loss per incident well into the tens of thousands of dollars. One number like that, tied to a scenario your board can picture (a fake email from the pastor asking the bookkeeper to move money), does more than a dozen abstract percentages.

    Whatever figure you choose, use a real one from a named source and say where it came from. A board’s trust in you is the currency you’re spending; don’t spend it on a statistic you can’t back up.

    Ask for a decision, not a reaction

    Here’s the part that turns a scary presentation into a productive one. Don’t end with “so we should take this seriously.” End with a specific, bounded ask the board can actually approve. Boards are built to decide; give them something to decide.

    That might be approving a small annual line for security tools and training. It might be authorizing staff to spend a set number of hours getting basic protections in place. It might be as simple as endorsing a plan to turn on multi-factor authentication everywhere and adopt two short policies. The ask should be concrete, affordable, and clearly the next step — not a blank check against an unbounded fear.

    It also helps enormously to walk in already knowing where you stand. If you can say “we’ve checked our basics and here’s where we’re strong and where we have gaps,” the conversation shifts from vague anxiety to a clear-eyed plan. A board responds very differently to “the sky might be falling” than to “here are our three gaps and here’s what closing them costs.”

    Leave them calmer than you found them

    The goal of the whole conversation is not fear. It’s confidence that a responsible plan is in motion. Fear paralyzes and fades; a plan gets funded and followed. If your board leaves the room thinking “we know where we stand and we know our next step,” you’ve done exactly what good governance of any risk requires — the same thing they already do with the building, the budget, and the insurance.

    If you’d like to walk into that meeting already knowing your gaps, that’s what our free assessment is built to give you: a plain-language baseline you can put in front of a board without a translator. Get on the launch list and you’ll be first in line when it opens.

    Sources

    • Federal Bureau of Investigation, Internet Crime Complaint Center (IC3), Internet Crime Report — business email compromise loss figures, ic3.gov.
    • Cybersecurity and Infrastructure Security Agency (CISA), Cyber Guidance for Small Businesses — on the automated, opportunistic nature of attacks against small organizations, cisa.gov.
    • National Council of Nonprofits, guidance on cybersecurity as a governance and risk-management responsibility, councilofnonprofits.org.

  • Back It Up So Ransomware Can’t Win

    Ransomware is a shakedown with a very specific business model. Attackers get into your systems, scramble every file so you can’t open it, and then offer to sell you the key. Member records, financial files, years of documents — all still there, all suddenly unreadable, with a countdown clock and a ransom demand attached. It’s frightening precisely because it takes your own information hostage.

    But that whole model has one fatal weakness, and it’s not clever software. It’s a good backup. If you have a clean, recent copy of your files stored somewhere the attacker couldn’t reach, their leverage evaporates. You don’t negotiate and you don’t pay; you wipe the affected machines, restore from your copy, and get back to work. The ransom only works if the backup doesn’t exist. So the single most powerful thing a small organization can do against ransomware isn’t buying protection — it’s making sure a copy of everything important lives somewhere safe.

    The rule that’s easy to remember: 3-2-1

    Security professionals boil good backups down to three numbers, and the reason it’s endured is that it’s genuinely easy to hold in your head. Keep three copies of your important data, on two different kinds of storage, with one of them kept somewhere else entirely.

    Three copies means the original you work with plus two backups, so that no single failure wipes you out. Two kinds of storage means you don’t put all your trust in one basket — for example, the working copy on your computer and a backup in a cloud service, rather than two folders on the same hard drive that dies together. And one copy kept off-site, away from your building, protects you against the physical disasters that a purely local backup can’t survive: a fire, a flood, a stolen laptop, or a burst pipe over the church office. For most small organizations today, that off-site copy is a reputable cloud backup, which quietly handles the “somewhere else” part for you.

    You don’t need expensive equipment to follow this. A church that keeps its files in Microsoft 365 or Google Workspace, plus a separate backup service or an external drive stored off-site, is already living the rule.

    The trap: the copy ransomware can also reach

    Here’s the detail that trips up organizations that thought they were covered. Ransomware doesn’t only scramble the computer it lands on. It reaches out to everything that computer is connected to — the shared network drive, the always-connected external disk, sometimes the synced cloud folder — and scrambles those too. A backup that’s plugged in and reachable all the time can get encrypted right alongside the original, which is a devastating thing to discover on the worst day.

    The protection is to keep at least one backup that isn’t constantly connected — what the pros call an offline or “air-gapped” copy, and what you can think of as a backup the ransomware simply can’t touch because there’s nothing linking the two. In practice that means an external drive you plug in for the backup and then unplug and put away, or a cloud backup service that keeps older versions the attacker can’t reach in and delete. The principle is the same either way: your safety copy should not be sitting there, always online, waiting to be scrambled with everything else.

    Cloud services help here in a way worth understanding. Many keep version history, meaning they hold earlier copies of your files even after the current ones change. If ransomware encrypts your synced documents, that version history can often let you roll back to the clean versions from before the attack. It’s not automatic and it’s not infinite, so it’s worth confirming your service offers it and knowing how to use it — but it’s a real advantage that a plain external drive doesn’t give you.

    The step almost everyone skips: test the restore

    This is the part that separates organizations that survive from ones that only thought they were protected. A backup you have never restored from is not a backup — it’s a hope. The time to discover that your backup was silently failing for six months, or that nobody knows the password to the backup account, or that the files won’t actually open, is not the morning after an attack.

    So test it, and test it before you need it. Once, pick a few real files, delete them from your working copy (or better, restore them to a separate folder so you don’t disturb anything), and bring them back from your backup. Confirm they open and they’re current. Do this when you first set up your backups and then on a simple schedule — a quarterly reminder on the calendar is plenty for most small organizations. The whole exercise takes fifteen minutes and converts a hope into a certainty.

    What to make sure is actually covered

    As you set this up, walk through where your important information actually lives, because it’s easy to back up the obvious things and miss the ones that would hurt most. Your email and shared documents are the big ones. But also think about your member and donor records, which often live inside a church management or database platform — check whether that platform backs itself up or whether that’s on you. The same goes for your bookkeeping and giving data. You don’t have to solve all of it in a day; you just want an honest inventory of what would be catastrophic to lose, and a copy of each of those things somewhere safe.

    Ransomware is designed to make you feel powerless, and against an organization with no backups, it is. Against one with three copies, one of them offline, and a restore they’ve actually tested, it’s an expensive nuisance that ends with you shrugging and restoring your files. That difference is entirely within your control, and it costs far less than most people assume.

    A good backup is your safety net for when something slips through. Turning on multi-factor authentication is how you stop most attacks from slipping through in the first place — the two work best as a pair, one preventing trouble and the other making sure it can’t become a disaster.

    If you’d like a clear read on whether your current backups would actually survive an attack, that’s one of the things our free assessment checks. Get on the launch list and you’ll be first in line when it opens.

    Sources

    • Cybersecurity and Infrastructure Security Agency (CISA), #StopRansomware Guide and Protecting Against Ransomware — on offline backups and the 3-2-1 approach, cisa.gov.
    • National Institute of Standards and Technology (NIST), Data Integrity: Recovering from Ransomware and Other Destructive Events — nist.gov.
    • Cybersecurity and Infrastructure Security Agency (CISA), guidance on testing backups and maintaining offline copies, cisa.gov.
  • Six Weeks of Risk: Fraud in the Year-End Giving Season

    Six Weeks of Risk: Fraud in the Year-End Giving Season

    It’s the third week of December. The office administrator is doing four jobs: the Christmas Eve bulletin, the poinsettia list, the volunteer schedule for two extra services, and the giving that’s arriving faster than any other time of the year.

    An email comes in from the pastor’s address at 8:40 in the evening. It’s short, and it apologizes for the hour.

    Sorry to do this so late — the Mercer gift needs to go out tonight so it lands before the 31st for their tax year. Wire details attached. I’m heading into the Christmas Eve rehearsal, can you handle it? Thank you for everything you do this season.

    Everything in that message is calibrated. The deadline is real for donors, so it doesn’t sound invented. The pastor genuinely is unreachable tonight. The gratitude is the exact thing an exhausted administrator wants to hear in the third week of December. And the request — move money quickly, at the end of the year — is the single most normal thing happening in the building right now.

    None of the attacks in this series are new in December. They just work better. That’s what this article is about, and it’s meant to be read in October, while there’s still time to do something.

    Why these six weeks are different

    Three things stack up at once.

    The volume. Many churches and nonprofits take in a large share of the year’s gifts in the final weeks — year-end appeals, memorial gifts, stock transfers, and the last Sunday of the year. Unusual transactions stop being unusual. A five-figure gift, a wire, a new vendor, a rush payment: in July any of those would prompt a question. In December they’re Tuesday.

    The people. The staff are tired and stretched. Volunteers who don’t normally touch anything are counting offering, staffing a table, running a card reader at the Christmas market. The treasurer is traveling. The bookkeeper is trying to close the year.

    The cover. Everyone expects urgency in December, which means urgency stops being a warning sign. The single most reliable tell in social engineering — this must happen right now — is indistinguishable from ordinary end-of-year work.

    An attacker doesn’t need a new technique to exploit that. They need a calendar.

    The seasonal patterns worth knowing

    Fake year-end appeals sent in your name. Your donors receive an appeal that looks like yours — your logo, your language, sometimes your pastor’s photograph — with a “give now” link that goes somewhere else entirely. The attacker doesn’t need access to your systems for this. Your appeal language is on your website, your donor names are often on your own published thank-you lists, and email addresses are widely available. The first you hear of it is a confused member calling to ask why the giving page looked different.

    Hijacked or spoofed giving links. A variant aimed at your real appeal. If your email is sent through a compromised account or your website is edited by someone who shouldn’t have access, the destination of the button changes while everything else stays the same. Check the actual link in every appeal before it goes out, and check it again after it’s sent by clicking through the version that arrived in your own inbox.

    A spike in gift-card and wire requests. The bookkeeper is already approving an unusual volume of unusual payments, which is exactly the noise these requests hide in. The gift-card version — “can you grab some cards for the staff, I’ll reimburse you” — is seasonal in a way that makes it especially credible in December. It isn’t credible in June.

    Card testing on your giving form. This one is worth decoding, because most church leaders have never heard of it and it’s genuinely common.

    Card testing is when someone with a batch of stolen card numbers uses an online form to find out which ones still work. They run a stream of very small donations — a dollar, two dollars, sometimes just an authorization — and watch which ones go through. The cards that succeed get sold or used elsewhere for real purchases.

    Church giving forms are attractive for this because they take any amount, they’re open to the public, they often don’t require an account, and nobody notices small gifts arriving. The cost to you is real: a processing fee on every attempt, chargebacks when the real cardholders dispute the charges, and — if the volume is high enough — trouble with your payment processor. You may also have to explain to a stranger why your church charged their card.

    The signs: a run of small donations in quick succession, often overnight, often with mismatched names and email addresses, frequently from the same or sequential card numbers.

    Fake vendor invoices timed for the rush. Year-end is when legitimate invoices pile up — the audiovisual contractor, the snow removal service, the printer who did the Christmas mailing. An invoice arriving in that stack from a plausible-sounding company, or a real vendor’s invoice with altered bank details, is unusually likely to be paid without a second look.

    And then January: the receipt phishing. After the season ends, donors expect an email from you about their giving statement — a donor claiming a deduction of $250 or more has to obtain and keep a written acknowledgment from you, so this is a genuinely predictable message. Attackers know it too. Your members receive a message that appears to come from the church, with a link to “download your 2026 giving statement,” which leads to a fake login page or a document that installs something. The congregation is the target here, not you, but your name is on it.

    What this costs when it works

    The FBI logged 24,768 business email compromise complaints in 2025, with reported losses of $3,046,598,558 — an average of about $123,005 per report. For most churches, that average is a staff position, or a roof.

    The recovery picture is genuinely hopeful, but only if you’re fast. The Bureau’s Recovery Asset Team ran 3,574 domestic incidents in 2025 and froze $507,042,623, and that process works far better inside the first 24 to 72 hours. Which is precisely the problem with December 27 — the day a fraudulent wire is most likely to go out is also the day nobody is checking anything.

    The checklist to run in October

    None of these takes long. All of them are much harder to do in December.

    Confirm who can authorize a payment, and write the money rule down. One page: who may approve a payment, above what amount a second person is required, and the rule that any change to payment details is verified by voice, on a phone number you already had, before the payment goes out. Not the number in the email. Not a number in the new invoice. The number you already had. Give the page to everyone who touches money, including the volunteer treasurer who only comes in on Thursdays.

    Add one seasonal line: no payment is made because it must happen tonight. If the deadline is genuinely real, tomorrow morning with a phone call still works.

    Check the giving platform’s fraud controls. Log in and look at what’s available — most platforms have more than churches turn on. You’re looking for: a minimum donation amount if your form allows any figure; rate limiting or velocity controls, which cap how many attempts can come from the same source in a short window; a CAPTCHA or similar bot check on the form; address verification and security-code checks on cards; and alerts when transaction volume spikes. If you can’t find these, email your platform’s support and ask them directly what protections against card testing are enabled on your account. That email takes four minutes and it’s the single most useful thing in this list.

    Verify your giving links everywhere they appear. The website, the bulletin, the QR code on the poster, the app, the text-to-give number, the link in the email footer, the social media profiles. Click every one and confirm where it lands. Do this yourself rather than asking whether someone else did.

    Brief the seasonal volunteers. The people who count offering at Christmas, staff the giving table, or handle the card reader at the market often serve only in this season and receive no orientation at all. Fifteen minutes covers it: two people count, nobody photographs a card, the giving links are these exact ones, and here’s who to call if something looks odd.

    Turn on multi-factor authentication before the season, not during it. Multi-factor authentication is the extra code or tap after your password. Microsoft’s own research finds it blocks more than 99.2% of account compromise attacks. Enable it on email, the giving platform, the church management system, and the bank — in October, when a hiccup is an inconvenience rather than an emergency.

    Decide now who gets called on December 27. Write down two names and two mobile numbers, and tell the office who they are. The most valuable thing on the whole list is a person who is genuinely willing to be phoned during the holidays about a payment that looks wrong. Say out loud that calling them is welcome, and that nobody will ever be criticized for calling about something that turns out to be fine.

    Watch the giving reports in real time. Assign one person to look at the day’s online gifts each morning through the season — not for reconciliation, just to see the shape of it. A screen of one-dollar donations at 3 a.m. is obvious the moment somebody looks, and invisible if nobody does until January.

    If something happens mid-season

    If a payment went out wrongly: call your bank’s fraud line first, then report to the FBI at ic3.gov using the words business email compromise. Do it the same day, not after the holiday. That’s what the recovery numbers above depend on.

    If your giving form is being used for card testing: contact your payment processor immediately and ask them to help you throttle or pause the form. Turning the form off for a few hours is far cheaper than the fees and chargebacks.

    If a fake appeal is circulating in your name: tell your congregation quickly and plainly through the channels you control, and say exactly what your real giving link is. Then report it. The FTC’s guidance for donors — check the organization before you give, and be wary of pressure and unusual payment methods — is worth passing along in your own words.

    In every case, tell someone the same day. The pattern that turns a contained mistake into a serious loss is a good person who is embarrassed and waits until after the holidays.

    What to do this week

    Send one email to your giving platform’s support team asking what fraud controls are enabled on your account and what they recommend for card testing and rate limiting. Then, while you’re at it, click every giving link you publish and confirm where each one lands.

    That’s half an hour in October, and it closes the two gaps that are hardest to close once the season starts.

    Then write two mobile numbers on the sheet by the office phone under a heading everyone will understand: call one of these before sending money, any time, including Christmas week.

    October is also a reasonable month to take stock more broadly. MissionDefend’s free assessment asks plain-English questions about how your organization handles email, donations, member data, and accounts, then returns a baseline score and a ranked list of what to fix first — which is a useful thing to have in hand before the giving season, not after.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; Internal Revenue Service, Charitable contributions: Written acknowledgments and Substantiating charitable contributions; Federal Trade Commission, Before Giving to a Charity; Microsoft, mandatory multifactor authentication guidance.

  • The Under-100 Church Security Checklist

    The Under-100 Church Security Checklist

    It’s a Thursday evening and the pastor has a browser tab open on a cybersecurity framework. It has six functions, more than twenty categories, and just over a hundred subcategories. Somewhere around subcategory forty it becomes clear that this document was written for an organization with a security team.

    This church has three staff. Two of them are part-time. The budget has other plans this quarter, and most of them involve the roof.

    So the tab gets closed, and nothing changes, and the reason nothing changes is not indifference. It’s that almost everything written about security assumes an IT department, and a church of eighty people does not have one and is not going to get one.

    Here is the honest version.

    For an organization your size, about twelve things matter. The rest can genuinely wait.

    Not “wait until you feel guilty enough.” Wait. As in: they are lower-value uses of your very limited hours, and doing them before the twelve would be a mistake.

    What follows is those twelve, ordered by how much risk each one removes per hour you spend on it. Do them in order. Most cost nothing.

    The first four, which do most of the work

    If you only ever do part of this list, do this part. These four close the routes that actually take money out of churches.

    1. Turn on multi-factor authentication for email. Multi-factor authentication (MFA) means a second step after your password — a code from an app, or a tap on your phone — so a stolen password isn’t enough on its own. This is first because nothing else comes close: Microsoft’s own research finds it blocks more than 99.2% of account compromise attacks. Time: 15 minutes per person. Cost: nothing — it’s included in Microsoft 365 and Google Workspace.

    2. Turn it on for the giving platform and the bank, separately. Each system has its own setting, and turning it on for email does nothing for the others. Your donation processor and your online banking are the two accounts where a compromise costs real money the same day. Time: 10 minutes each. Cost: nothing.

    3. Write down the money rule and give it to whoever pays the bills. One sentence: any change to payment details — a vendor’s bank account, an employee’s direct deposit, a wire request — is verified by a phone call to a number we already had, before the money goes out. Not the number in the email. The number you already had. This single rule defeats the most expensive category of attack aimed at churches; in 2025 the FBI logged 24,768 business email compromise complaints totalling $3,046,598,558, an average of about $123,005 per report. Time: 10 minutes to write, 5 minutes to say at a staff meeting. Cost: nothing.

    4. Remove access for everyone who left. The youth intern from two summers ago. The treasurer who resigned in March. The volunteer who built the website. Make a list of every system — email, giving platform, church management software, website, social media, the bank — and go through it once. Departed people’s accounts are the most common quiet hole in a small organization, because offboarding is nobody’s job. Time: 60–90 minutes the first time, 15 minutes a year after. Cost: nothing, and it may reduce your software bill.

    The other eight

    Lower urgency, still genuinely worth the hour. Keep going in order.

    5. Get a real backup, and then test restoring from it. CISA’s guidance for small organizations is the 3-2-1 rule: “3 copies of important files, 2 different types of storage media (like a hard drive and the cloud), 1 copy stored off-site, away from your business location.” Then the part almost everyone skips — CISA also says to “test backup procedure to make sure your team can rapidly restore data both fully and partially.” An untested backup is a hope, not a backup. Restore one folder. Confirm it opens. Time: 60 minutes to set up, 20 minutes to test. Cost: often under $10/month, sometimes nothing if you already have cloud storage.

    6. Put every password in a password manager, and stop reusing them. A password manager is an app that generates and remembers a different long password for every account, so you only memorize one. The reason this matters: when any website you use gets breached, attackers try that password everywhere else. Reuse turns one company’s bad day into your bad day. Time: 45 minutes to set up, then a few minutes each time you log into something. Cost: free tiers exist; paid plans for a small team are typically a few dollars a month.

    7. Turn on automatic updates everywhere. Computers, phones, and — critically — the church website if it runs on WordPress or similar. Most successful attacks use a flaw that was fixed months earlier by an update nobody installed. Time: 20 minutes total. Cost: nothing.

    8. Check for mail rules and forwarding nobody set up. In each staff mailbox, look at the rules and forwarding settings. A rule you don’t remember creating — especially one that forwards mail elsewhere, or files anything containing “invoice” or “payroll” into a folder you never open — is one of the clearest signs an account has been compromised. Time: 5 minutes per mailbox, once a quarter. Cost: nothing.

    9. Limit who can reach the sensitive files. Background checks, payroll, counseling notes, giving records. For each category, name the two people who need access, and remove everyone else. Shared drives default to convenient rather than restrictive, which usually means “everyone with a login.” Time: 45 minutes. Cost: nothing.

    10. Turn on full-disk encryption on every laptop. Encryption means the drive is scrambled and unreadable without the password. It’s BitLocker on Windows — shown as device encryption on Windows Home — and FileVault on Mac, both built in. A laptop stolen from a car is one of the most common ways a small organization loses data, and in many states encryption changes what that theft legally means. Time: 10 minutes per machine. Cost: nothing.

    11. Get a second pair of eyes on the money. Two people see the bank statement every month, not one. Turn on transaction alerts so someone gets a text when money moves. This isn’t about distrust — it’s about making sure a fraudulent transfer is caught in hours rather than at the next quarterly report. Time: 20 minutes to set up, 10 minutes a month. Cost: nothing.

    12. Tell the congregation what you will never ask them for. One line in the newsletter and on the website: the church will never text or email you asking for gift cards, and will never call asking for your account details. Impersonation of the pastor is one of the most common attacks aimed at congregations, and older members are targeted hardest: the FBI logged 201,266 complaints from victims aged 60 and over in 2025, totalling $7.748 billion — complaints up 37% and losses up 59% in a single year. Time: 10 minutes. Cost: nothing.

    That’s the list. Total time if you did it all in one long push: about eight hours. Total cost: for most churches, somewhere between nothing and a hundred dollars a year.

    What you can honestly skip, for now

    This part matters as much as the list, because permission to skip is what makes a list like this get used. If everything is essential, nothing gets done.

    A phishing simulation platform. Monthly fake-phishing campaigns with dashboards are a real product with real value — for organizations with a hundred employees. With three staff, a five-minute conversation at a staff meeting accomplishes more, faster, and doesn’t cost per seat.

    A written information security policy. The forty-page kind. What you need instead is the money rule on one piece of paper and a written retention rule for sensitive records. Policy documents are how larger organizations communicate at scale. You can just talk to each other.

    Extra antivirus software. Windows includes antivirus protection built in and turned on. For a small church, adding a second paid product mostly adds cost and confusion. Keep the built-in one and let it update.

    A VPN. A VPN encrypts your internet traffic, and it’s genuinely useful in specific situations. It is not a general-purpose security upgrade, and buying one will not protect a mailbox with no MFA on it. Not on the critical path.

    A penetration test. A professional break-in attempt, priced accordingly. It’s a valuable exercise for an organization that has already done the twelve above. Paying for one before you’ve turned on MFA is like hiring a structural engineer to inspect a house with the front door propped open.

    Formal compliance frameworks. SOC 2, full NIST implementations, ISO certifications. These exist because large customers demand proof. Nobody is asking your church for a SOC 2 report.

    Encrypting routine email. Worth doing for specific sensitive attachments. Not worth the friction for everyday correspondence, and the friction is exactly why organizations that try it stop within a month.

    One thing that is not on the skip list: cyber liability insurance. That one costs money, so it doesn’t belong on a free checklist — but ask your broker what your existing policy covers, whether cyber coverage is available as an endorsement, and what it would cost. Five-minute email, potentially significant answer. Many churches discover they already have some coverage and nobody knew.

    A quarter, one item a week

    Twelve items, twelve weeks. That’s the sequencing that actually works, because it asks for twenty minutes on a Tuesday rather than a whole Saturday you’ll never find.

    Weeks 1–2: MFA on email, then on giving and banking.
    Week 3: write the money rule, and say it out loud at a staff meeting.
    Week 4: the departed-people access review.
    Weeks 5–6: set up the backup, then test the restore.
    Week 7: password manager.
    Week 8: automatic updates.
    Week 9: mail rules check.
    Week 10: file access cleanup.
    Week 11: laptop encryption.
    Week 12: bank alerts, and the newsletter line to the congregation.

    Put the twelve dates in a calendar today, with the item name in the subject line. That’s the difference between a good list and a finished one.

    And a note for the person reading this who feels behind: none of this is a failing. A church of eighty people running on volunteer hours was never resourced to do any of it, and the fact that it hasn’t been done says nothing about anyone’s diligence. It’s a consequence of how small organizations work. The list above is simply the shortest path from here to genuinely well-defended, and it is much shorter than the internet led you to believe.

    What to do this week

    Item one. Turn on multi-factor authentication for your email — every staff account, including the shared office mailbox. Fifteen minutes each, no cost.

    Then put the other eleven items in your calendar, one a week. Whichever way the quarter goes, you’ll have done more for your organization’s security than most churches your size manage in a decade.

    MissionDefend’s free assessment is built for exactly this situation. It asks plain-English questions about how you handle email, donations, member data, and accounts — no jargon and no IT knowledge assumed — and gives you a baseline score plus a ranked list of what to fix first, so you know which of the twelve to start with.

    Join the launch list →

    No spam and no sales calls — just one email when it’s live.

    Related reading

    MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.

    Sources: Microsoft, Mandatory multifactor authentication guidance; Cybersecurity and Infrastructure Security Agency, Back Up Business Data; FBI Internet Crime Complaint Center, 2025 Internet Crime Report.